Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    118s
  • max time network
    118s
  • platform
    windows7_x64
  • resource
    win7-20240221-en
  • resource tags

    arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
  • submitted
    20/04/2024, 18:33

General

  • Target

    fd5f67b71543f0d0b620161bfcd1151c_JaffaCakes118.exe

  • Size

    356KB

  • MD5

    fd5f67b71543f0d0b620161bfcd1151c

  • SHA1

    c8c938f4edbf3793b6c8b680b3474879c8185ed9

  • SHA256

    730b5b1ff9760f80340954c515fdc16e0d0ba664cfbc0f2157e8228c172f8000

  • SHA512

    48a39c34c3247fa5a7ae9e4e2a1a5e254aca691a170b8d64dd211f67aad0e6841676120585b9839bbbbd6dc39484bf17e417e6d80e724f9129c716f6d411281c

  • SSDEEP

    6144:7vbx8GUoAxgeWj2geARcUPuLrB3cp6FWw21EN:7NVAx2LULN3QEWwOk

Score
7/10

Malware Config

Signatures

  • Deletes itself 1 IoCs
  • Executes dropped EXE 2 IoCs
  • Loads dropped DLL 5 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Suspicious use of SetThreadContext 3 IoCs
  • Suspicious use of WriteProcessMemory 22 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\fd5f67b71543f0d0b620161bfcd1151c_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\fd5f67b71543f0d0b620161bfcd1151c_JaffaCakes118.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious use of WriteProcessMemory
    PID:2864
    • C:\Users\Admin\AppData\Local\Temp\fd5f67b71543f0d0b620161bfcd1151c_JaffaCakes118.exe
      "C:\Users\Admin\AppData\Local\Temp\fd5f67b71543f0d0b620161bfcd1151c_JaffaCakes118.exe"
      2⤵
      • Loads dropped DLL
      • Adds Run key to start application
      • Suspicious use of WriteProcessMemory
      PID:2912
      • C:\ProgramData\E3IwONGj\gTsei4KNX0Kr.exe
        "C:\ProgramData\E3IwONGj\gTsei4KNX0Kr.exe"
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Suspicious use of SetThreadContext
        • Suspicious use of WriteProcessMemory
        PID:2960
        • C:\ProgramData\E3IwONGj\gTsei4KNX0Kr.exe
          "C:\ProgramData\E3IwONGj\gTsei4KNX0Kr.exe"
          4⤵
          • Deletes itself
          • Executes dropped EXE
          • Loads dropped DLL
          • Suspicious use of SetThreadContext
          • Suspicious use of WriteProcessMemory
          PID:2648
          • C:\Program Files (x86)\Windows Sidebar\sidebar.exe
            "C:\Program Files (x86)\Windows Sidebar\sidebar.exe" /i:2648
            5⤵
              PID:2608

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • \ProgramData\E3IwONGj\gTsei4KNX0Kr.exe

      Filesize

      356KB

      MD5

      fd5f67b71543f0d0b620161bfcd1151c

      SHA1

      c8c938f4edbf3793b6c8b680b3474879c8185ed9

      SHA256

      730b5b1ff9760f80340954c515fdc16e0d0ba664cfbc0f2157e8228c172f8000

      SHA512

      48a39c34c3247fa5a7ae9e4e2a1a5e254aca691a170b8d64dd211f67aad0e6841676120585b9839bbbbd6dc39484bf17e417e6d80e724f9129c716f6d411281c

    • memory/2608-54-0x0000000000400000-0x000000000045E000-memory.dmp

      Filesize

      376KB

    • memory/2608-51-0x0000000000400000-0x000000000045E000-memory.dmp

      Filesize

      376KB

    • memory/2608-46-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

      Filesize

      4KB

    • memory/2648-52-0x0000000000400000-0x000000000045E000-memory.dmp

      Filesize

      376KB

    • memory/2648-41-0x0000000000400000-0x000000000045E000-memory.dmp

      Filesize

      376KB

    • memory/2864-7-0x0000000077130000-0x0000000077240000-memory.dmp

      Filesize

      1.1MB

    • memory/2864-5-0x0000000000400000-0x0000000000464000-memory.dmp

      Filesize

      400KB

    • memory/2912-9-0x0000000000400000-0x000000000045E000-memory.dmp

      Filesize

      376KB

    • memory/2912-8-0x0000000000400000-0x000000000045E000-memory.dmp

      Filesize

      376KB

    • memory/2912-24-0x0000000000400000-0x000000000045E000-memory.dmp

      Filesize

      376KB

    • memory/2912-6-0x0000000000400000-0x000000000045E000-memory.dmp

      Filesize

      376KB

    • memory/2912-0-0x0000000000400000-0x000000000045E000-memory.dmp

      Filesize

      376KB

    • memory/2912-4-0x0000000000400000-0x000000000045E000-memory.dmp

      Filesize

      376KB

    • memory/2912-2-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

      Filesize

      4KB

    • memory/2960-30-0x0000000077130000-0x0000000077240000-memory.dmp

      Filesize

      1.1MB

    • memory/2960-36-0x0000000000400000-0x0000000000464000-memory.dmp

      Filesize

      400KB

    • memory/2960-39-0x0000000077130000-0x0000000077240000-memory.dmp

      Filesize

      1.1MB